From patchwork Fri Jan 30 06:58:23 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoshihiro Shimoda X-Patchwork-Id: 5746991 X-Patchwork-Delegate: geert@linux-m68k.org Return-Path: X-Original-To: patchwork-linux-sh@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id B46CA9F358 for ; Fri, 30 Jan 2015 06:58:36 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id C270820225 for ; Fri, 30 Jan 2015 06:58:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8E64A2021B for ; Fri, 30 Jan 2015 06:58:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753217AbbA3G6e (ORCPT ); Fri, 30 Jan 2015 01:58:34 -0500 Received: from relmlor3.renesas.com ([210.160.252.173]:60522 "EHLO relmlie2.idc.renesas.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752710AbbA3G6d (ORCPT ); Fri, 30 Jan 2015 01:58:33 -0500 Received: from unknown (HELO relmlir4.idc.renesas.com) ([10.200.68.154]) by relmlie2.idc.renesas.com with ESMTP; 30 Jan 2015 15:58:31 +0900 Received: from relmlac3.idc.renesas.com (relmlac3.idc.renesas.com [10.200.69.23]) by relmlir4.idc.renesas.com (Postfix) with ESMTP id B56943D60A; Fri, 30 Jan 2015 15:58:31 +0900 (JST) Received: by relmlac3.idc.renesas.com (Postfix, from userid 0) id 87FB91806F; Fri, 30 Jan 2015 15:58:31 +0900 (JST) Received: from relmlac3.idc.renesas.com (localhost [127.0.0.1]) by relmlac3.idc.renesas.com (Postfix) with ESMTP id 7EB7D1800A; Fri, 30 Jan 2015 15:58:31 +0900 (JST) Received: from relmlii2.idc.renesas.com [10.200.68.66] by relmlac3.idc.renesas.com with ESMTP id RAF29056; Fri, 30 Jan 2015 15:58:31 +0900 X-IronPort-AV: E=Sophos;i="5.09,490,1418050800"; d="scan'208";a="179926806" Received: from mail-sg1lp0086.outbound.protection.outlook.com (HELO APAC01-SG1-obe.outbound.protection.outlook.com) ([207.46.51.86]) by relmlii2.idc.renesas.com with ESMTP/TLS/AES256-SHA; 30 Jan 2015 15:58:31 +0900 Received: from localhost (211.11.155.147) by SIXPR06MB333.apcprd06.prod.outlook.com (10.141.120.15) with Microsoft SMTP Server (TLS) id 15.1.65.19; Fri, 30 Jan 2015 06:58:29 +0000 From: Yoshihiro Shimoda To: , CC: , , , Yoshihiro Shimoda Subject: [PATCH] usb: renesas_usbhs: fix NULL pointer dereference in dma_release_channel() Date: Fri, 30 Jan 2015 15:58:23 +0900 Message-ID: <1422601103-1144-1-git-send-email-yoshihiro.shimoda.uh@renesas.com> X-Mailer: git-send-email 1.9.4.msysgit.1 MIME-Version: 1.0 X-Originating-IP: [211.11.155.147] X-ClientProxiedBy: HKXPR02CA0042.apcprd02.prod.outlook.com (25.161.48.27) To SIXPR06MB333.apcprd06.prod.outlook.com (10.141.120.15) Authentication-Results: linuxfoundation.org; dkim=none (message not signed) header.d=none; linuxfoundation.org; dmarc=none action=none header.from=renesas.com; X-DmarcAction-Test: None X-Microsoft-Antispam: UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(3005004);SRVR:SIXPR06MB333; X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004); SRVR:SIXPR06MB333; X-Forefront-PRVS: 04724A515E X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(6069001)(6009001)(78352002)(87976001)(40100003)(77096005)(33646002)(50226001)(50986999)(46102003)(92566002)(229853001)(122386002)(77156002)(76506005)(48376002)(42382002)(66066001)(50466002)(19580405001)(36756003)(42186005)(575784001)(62966003)(19580395003)(47776003); DIR:OUT; SFP:1102; SCL:1; SRVR:SIXPR06MB333; H:localhost; FPR:; SPF:None; MLV:sfv; LANG:en; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:;SRVR:SIXPR06MB333; X-OriginatorOrg: renesas.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jan 2015 06:58:29.0994 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: SIXPR06MB333 Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes an issue that the following commit causes NULL pointer dereference in dma_release_channel(). "usb: renesas_usbhs: add support for requesting DT DMA" (commit id abd2dbf6bb1b5f3a03a8c76b1a8879da1dd30caa) The usbhsf_dma_init_dt() should set fifo->{t,r}x_chan to NULL if dma_request_slave_channel_reason() returns IS_ERR value. Otherwise, usbhsf_dma_quit() will call dma_release_channel(), and then NULL pointer dereference happens. Reported-by: Simon Horman Signed-off-by: Yoshihiro Shimoda Acked-by: Geert Uytterhoeven Tested-by: Simon Horman --- This patch is based on Felipe's usb.git / testing/next branch. (commit id =7db3990cb707ff91cd6507d53a0a730afe97) drivers/usb/renesas_usbhs/fifo.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c index 4c086b1..d891bff 100644 --- a/drivers/usb/renesas_usbhs/fifo.c +++ b/drivers/usb/renesas_usbhs/fifo.c @@ -1072,7 +1072,11 @@ static void usbhsf_dma_init_pdev(struct usbhs_fifo *fifo) static void usbhsf_dma_init_dt(struct device *dev, struct usbhs_fifo *fifo) { fifo->tx_chan = dma_request_slave_channel_reason(dev, "tx"); + if (IS_ERR(fifo->tx_chan)) + fifo->tx_chan = NULL; fifo->rx_chan = dma_request_slave_channel_reason(dev, "rx"); + if (IS_ERR(fifo->rx_chan)) + fifo->rx_chan = NULL; } static void usbhsf_dma_init(struct usbhs_priv *priv,